WordPress Plugin Vulnerabilities

WP Responsive header image slider <= 3.2.1 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
responsive-header-image-slider
No known fix

References

CVE
CVE-2023-5334
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6953dea2-ca2d-4283-97c2-45c3420d9390

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
a1796a01-c4d1-42a0-ba0c-2286adf5ae9e

Timeline

Publicly Published
2023-10-02 (about 8 months ago)
Added
2023-10-12 (about 7 months ago)
Last Updated
2023-10-12 (about 7 months ago)

Other

Published
Title
Published
2022-12-05
Title
Loginizer < 1.7.6 - Reflected XSS
Published
2024-01-23
Title
illi Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting
Published
2024-01-17
Title
WP To Do < 1.2.9 - Contributor+ Stored XSS
Published
2024-03-25
Title
Fancy Comments WordPress < 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2021-05-31
Title
FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting